The Final CCPA Amendments Are In

Data brokers must now register with the California Attorney General’s office. “Data broker” is a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.

Roughly equivalent to the Vermont data broker registration law.

• Exemption for “employee” data until Jan. 1, 2021. Included in this is “information collected from a natural person by a business in the course of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business.”
• These individuals must still be informed of the categories of personal information to be collected and the purposes for which those categories shall be used by the business. They also retain their right to bring a private action for a data breach under §150.

Given that this law was consumer centric as originally conceived, applicability to employees in any context is arguably a significant change.

Definition of “personal information” now has the word “reasonably” in front of it, as in: 1798.140(o)(1) “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

It’s unclear how much this change will benefit the defendants in breach litigation, given that “indirectly” is not a tough hurdle to clear.

Any information that is lawfully made available from federal, state, or local government records is now “publicly available” and not “personal information,” and does not require a “purpose” analysis.

Addresses the problem of original bill text, which required determining whether public data is being used for a purpose outside its originally intended purpose.

• Exempts data that is “deidentified” and “aggregate” data, because neither qualifies as “personal information” under the CCPA’s definition.
• Prohibit a business from discriminating against the consumer for exercising any of the consumer’s rights under the act, except if the differential treatment is reasonably related to value provided to the business by the consumer’s data. Clarifies “that a consumer has the right to request the” specific pieces of personal information the business has collected about that consumer.
• Clarifies that a business is not required to “collect personal information that it would not otherwise collect in the ordinary course of its business, retain personal information for longer than it would otherwise retain such information in the ordinary course of its business.”
• Clarifies and (arguably) broadens the inapplicability of the CCPA to personal information collected pursuant to the Fair Credit Reporting Act (FCRA).

Sometimes referred to as a “clean up” bill, because it fixed several drafting errors.

Provides a “business-to-business” exemption, which only lasts one year. Essentially, applies to employees that are conducting due diligence regarding a product or a service from another entity. However, the “do not sell,” the non-discrimination, and the private right of action (in the event of a breach) provisions still apply.

The “business-to-business” (or B2B) application of the CCPA is similar to how the GDPR approaches personal data gathered in business contexts. The 1-year exemption period was likely developed to lessen the burden on so-called MarTech companies (e.g., Salesforce.com, Marketo, Eloqua, etc.).

Provides for the California Attorney General “to establish rules and procedures on how to process and comply with verifiable consumer requests for specific pieces of personal information relating to a household in order to address obstacles to implementation and privacy concerns.”

The driver behind adding/ clarifying the creation of rules by the California Attorney General regarding the verification needed for revealing “household” personal information is the potential for abuse (such as in divorce proceedings).

Provides an exception to the right to opt out vehicle information or ownership information retained or shared between a new motor vehicle dealer and the vehicle’s manufacturer, if the information is shared for the purpose of effectuating or in anticipation of effectuating a vehicle repair covered by a vehicle warranty or a recall.

Arguably, §1798.105(d)(1), (7), and/or (9) of the Act already imply such an exception.

Provides an exception to the right to request a business to delete personal information about the consumer if the personal information is necessary to fulfill the terms of a written warranty or product recall conducted in accordance with federal law.

Arguably, §1798.145(a) of the Act obviates the need for this exception.

Adds the following to the definition of “personal information” for breach reporting purposes:

• Unique biometric data
• Tax identification numbers
• Passport numbers
• Military identification numbers
• Unique identification numbers issued on a government document (in addition to those for driver’s licenses and California identification cards)

These changes apply to California government agencies and businesses.

Expands the type of personal information that implicates breach reporting and, consequently, the opportunities for class-action litigation related to a breach.